Gitlab CI/CD与HashiCorp Vault集成的权限配置问题咨询

配置GitLab CI流水线从HashiCorp Vault获取密钥时，出现403权限拒绝错误，切换为root策略后流水线可正常运行，需编写安全的Vault策略替代root策略。

错误日志：

Resolving secrets
Resolving secret "VAULT_SECRET_ID"...
Using "vault" secret resolver...
ERROR: Job failed (system failure): resolving secrets: reading secret: reading from Vault: api error: status code 403: 1 error occurred:
    * permission denied

现有Vault JWT认证Terraform配置 #

data "vault_policy_document" "gitlab_jwt" {
  rule {
    capabilities = ["create", "read"]
    path         = "auth/jwt/gitlab"
  }

  rule {
    capabilities = ["read"]
    path         = "auth/jwt/gitlab/role/gitlab"
  }

  rule {
    capabilities = ["read"]
    path         = "devops/example/secret"
  }
}

resource "vault_policy" "gitlab_jwt" {
  name   = "vault-gitlab-jwt"
  policy = data.vault_policy_document.gitlab_jwt.hcl
}

resource "vault_jwt_auth_backend" "gitlab" {
  description  = "Gitlab JWT authentication"
  path         = "jwt/gitlab"
  bound_issuer = "https://gitlab.com"
  jwks_url     = "https://gitlab.com/-/jwks"
}

resource "vault_jwt_auth_backend_role" "gitlab" {
  backend                 = vault_jwt_auth_backend.gitlab.path
  role_name               = "gitlab"
  role_type               = "jwt"
  token_no_default_policy = true
  token_explicit_max_ttl  = 60
  token_policies          = [vault_policy.gitlab_jwt.name]
  user_claim              = "user_login"
  bound_claims_type       = "glob"
  bound_claims = {
    project_path = "example/*"
  }
}

现有.gitlab-ci.yml配置 #

variables:
  VAULT_SERVER_URL: "https://vault.example.com"
  VAULT_AUTH_PATH: "jwt/gitlab"
  VAULT_AUTH_ROLE: "gitlab"
  VAULT_FORMAT: "json"


vault:
  id_tokens:
    VAULT_ID_TOKEN:
      aud: $VAULT_SERVER_URL
  secrets:
    VAULT_ROLE_ID:
      vault: example/secret/key@devops
      file: false
    VAULT_SECRET_ID:
      vault: example/secret/key@devops
      file: false
  ...

问题核心是KV-V2引擎的路径权限配置错误，且包含了不必要的认证后端管理权限。以下是修正后的安全策略：

data "vault_policy_document" "gitlab_jwt" {
  rule {
    capabilities = ["read"]
    # KV-V2引擎的秘密数据读取路径需添加data前缀，格式为：<挂载路径>/data/<秘密路径>
    path         = "devops/data/example/secret"
  }

  # 可选：若需读取秘密的元数据，添加此规则
  rule {
    capabilities = ["read"]
    path         = "devops/metadata/example/secret"
  }
}

resource "vault_policy" "gitlab_jwt" {
  name   = "vault-gitlab-jwt"
  policy = data.vault_policy_document.gitlab_jwt.hcl
}

关键说明 #

• KV-V2引擎与KV-V1路径结构不同，实际秘密数据存储在data子路径下，元数据在metadata子路径下，原策略的路径不符合KV-V2的要求。
• 移除了auth/jwt/gitlab相关的权限，这些是管理Vault认证后端的权限，GitLab CI的JWT认证流程不需要此类权限。
• 仅保留读取目标秘密的最小权限，符合最小权限原则，配合JWT角色中bound_claims的项目范围限制，进一步提升安全性。

内容的提问来源于stack exchange，提问作者thiagoaraujogit